twitter-watch
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/watch.pyinvokes external commands usingsubprocess.runto interact with theagent-browserCLI and verify the presence ofnpm. On Windows systems, it employsshell=Trueto ensure compatible command resolution within the shell environment.\n- [PERSISTENCE]: The skill programmatically updates the~/.agent-browser/config.jsonconfiguration file to setautoConnect: true. This modification is intended to ensure that the automation tool consistently recognizes and connects to the user's active browser session during subsequent runs.\n- [INDIRECT_PROMPT_INJECTION]: The skill acts as a surface for indirect prompt injection by ingesting external data from user-provided files and scraping content from live Twitter web pages.\n - Ingestion points: The agent reads tweet links from a user-specified text file (
links.txt) and extracts interaction data (likes, retweets, etc.) from the HTML content of Twitter pages.\n - Boundary markers: Explicit boundary markers or instructions to ignore embedded commands are not utilized, as the data processing is performed by a specialized Python script rather than being directly interpolated into an LLM prompt.\n
- Capability inventory: The skill possesses capabilities to execute shell commands, write to the local file system (for reports and configuration), and perform network operations via the controlled browser.\n
- Sanitization: The script implements regex-based extraction for tweet IDs and interaction metrics, effectively filtering out non-numerical content and limiting the risk of malicious text influencing the application logic.
Audit Metadata